Gettr Transcribe

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:59 PM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent, but it needs review because unvalidated inputs can access non-GETTR resources or write outside the intended output folder.

Install only if you are comfortable running local shell scripts, ffmpeg, brew, pip, and MLX Whisper on media you select. Use only trusted GETTR-derived media URLs, keep slugs to simple letters/numbers/dashes/underscores, avoid elevated privileges, and consider pinning dependency and model versions before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Package and Runtime Model Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-20`; additional runtime reference at `scripts/run_pipeline.sh:115-128` **Vulnerability Type**: Unpinned third-party package and model dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml { "id": "mlx-whisper", "kind": "pip", "package": "mlx-whisper", "bins": ["mlx_whisper"], "label": "Install mlx-whisper (pip)", }, ``` The pipeline also loads a model using a mutable repository identifier: ```bash mlx_whisper "$AUDIO_FILE" \ -f vtt \ -o "$OUT_DIR" \ --model mlx-community/whisper-large-v3-turbo \ --condition-on-previous-text False \ --word-timestamps True \ $LANG_FLAG \ 2>&1 || { echo "[warn] Retrying without extra flags..." >&2 mlx_whisper "$AUDIO_FILE" \ -f vtt \ -o "$OUT_DIR" \ --model mlx-community/whisper-large-v3-turbo \ $LANG_FLAG } ``` Related installation instructions also use an unpinned dependency: ```bash pip install mlx-whisper ``` ### Technical Analysis The Skill installs `mlx-whisper` without pinning an audited version or verifying package hashes. Consequently, the actual package installed depends on the current state of the configured Python package index at installation time. The transcription model is also selected through the mutable repository identifier `mlx-community/whisper-large-v3-turbo`, without an immutable revision or integrity digest. Changes to the upstream package or model repository can therefore alter the code or model artifacts used after this Skill has been reviewed. This creates a supply-chain risk. If an upstream release, maintainer account, package index, or model repository is compromised, users following the documented workflow may retrieve a malicious or unexpectedly changed component. ### Attack Path 1. An attacker compromises the upstream Python package, its publisher account, the package distribution channel, or the referenced model repository. 2. The attacker publishes a mal ...[truncated 1047 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `mlx-whisper` to a specifically audited version rather than installing the latest available release. 2. Maintain dependencies in a lock file or constraints file with cryptographic hashes, and install them using hash verification such as `pip install --require-hashes`. 3. Pin the Hugging Face model to an immutable commit revision or verified artifact digest instead of relying only on a mutable repository name. 4. Document the approved package index and model registry, and reject unexpected mirrors or alternate sources. 5. Perform dependency vulnerability and provenance checks as part of release review. 6. Re-test the pipeline before intentionally updating either the package version or model revision. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_pipeline.sh:69
• Finding: Output Path Traversal Through an Unvalidated Slug<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run_pipeline.sh:69-88` **Vulnerability Type**: Path traversal and unintended file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash VIDEO_URL="$1" SLUG="$2" OUTPUT_BASE="${3:-./out}" # Check prerequisites for cmd in ffmpeg mlx_whisper; do if ! command -v "$cmd" >/dev/null 2>&1; then echo "[error] Required command not found: $cmd" >&2 if [[ "$cmd" == "ffmpeg" ]]; then echo "[hint] Install with: brew install ffmpeg" >&2 elif [[ "$cmd" == "mlx_whisper" ]]; then echo "[hint] Install with: pip install mlx-whisper" >&2 fi exit 127 fi done echo "[info] Video URL: $VIDEO_URL" >&2 echo "[info] Slug: $SLUG" >&2 # Set up output directory OUT_DIR="$OUTPUT_BASE/gettr-transcribe/$SLUG" mkdir -p "$OUT_DIR" AUDIO_FILE="$OUT_DIR/audio.wav" VTT_FILE="$OUT_DIR/audio.vtt" ``` The downloader later enables unconditional output replacement: ```bash if ! ffmpeg -hide_banner -loglevel warning -y -i "$IN_URL" \ -vn \ -ac 1 \ -ar 16000 \ -acodec pcm_s16le \ "$OUT_FILE" 2>&1; then ``` ### Technical Analysis The caller-controlled `SLUG` value is directly concatenated into `OUT_DIR` without validation or canonicalization. Although shell quoting prevents shell metacharacters from becoming command injection, it does not prevent filesystem traversal components such as `../`. A slug containing traversal segments can resolve outside `"$OUTPUT_BASE/gettr-transcribe"`. The script then creates that directory and writes fixed filenames named `audio.wav` and `audio.vtt`. Because `ffmpeg` is invoked with `-y`, an existing `audio.wav` at the resolved destination may be overwritten without confirmation. The optional caller-controlled `OUTPUT_BASE` also permits arbitrary output placement by design, but traversal in `SLUG` violates the documented output-directory boundary even when the default base is used. ### Attack Path 1. An attacker persuades the caller or controlling a ...[truncated 1106 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the slug against a conservative allowlist before constructing any path: ```bash if [[ ! "$SLUG" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "[error] Invalid slug" >&2 exit 2 fi ``` 2. Explicitly reject empty values, path separators, `.` components, and `..` components. 3. Canonicalize both the output root and resulting destination, then verify that the destination remains beneath the canonical output root. 4. Consider deriving the slug internally from a validated GETTR URL rather than accepting an independent caller-provided path component. 5. Avoid unconditional overwrite where possible. Refuse to replace existing files unless an explicit overwrite option is provided. 6. Document that the pipeline should not be run with elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/download_audio.sh:9
• Finding: Unrestricted Media Input Permits Non-GETTR Local and Network Resource Access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download_audio.sh:9-29`; caller entry point at `scripts/run_pipeline.sh:69,94` **Vulnerability Type**: Unvalidated URL scheme and destination host **Risk Level**: Low ### Vulnerable Code ```bash IN_URL="$1" OUT_FILE="$2" if ! command -v ffmpeg >/dev/null 2>&1; then echo "ffmpeg not found. Install with: brew install ffmpeg" >&2 exit 127 fi mkdir -p "$(dirname "$OUT_FILE")" # Extract audio directly: 16kHz mono WAV (optimal for Whisper) # -vn: no video # -ac 1: mono # -ar 16000: 16kHz sample rate # -acodec pcm_s16le: 16-bit PCM (standard WAV) # -hide_banner -loglevel warning: cleaner output if ! ffmpeg -hide_banner -loglevel warning -y -i "$IN_URL" \ -vn \ -ac 1 \ -ar 16000 \ -acodec pcm_s16le \ "$OUT_FILE" 2>&1; then ``` The pipeline passes the value through without validation: ```bash VIDEO_URL="$1" ``` ```bash "$SCRIPT_DIR/download_audio.sh" "$VIDEO_URL" "$AUDIO_FILE" >&2 || { echo "[error] Failed to download audio" >&2 exit 1 } ``` ### Technical Analysis The Skill is documented as downloading media from GETTR, but the executable scripts do not validate the input scheme, hostname, or resource type. Any value accepted by the installed `ffmpeg` build is passed to its input handler. Depending on enabled ffmpeg protocols and demuxers, the argument may reference arbitrary remote hosts, internal network services, or local files rather than an approved GETTR media endpoint. This creates a server-side request forgery-style primitive when an untrusted party can influence the argument supplied by an agent or automation system. It can also cause local files to be opened and processed if they are valid media. Quoting `"$IN_URL"` prevents shell command injection, but it does not restrict which resource ffmpeg accesses. ### Attack Path 1. An attacker supplies a crafted media argument instead of a legitimate GETTR media URL. 2. The controlling agent or user passes that value to `run_ ...[truncated 1012 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the input as a URL before invoking ffmpeg. 2. Require HTTPS and reject local paths, `file:` URLs, loopback addresses, link-local addresses, private network destinations, and unsupported schemes. 3. Allowlist the expected GETTR media hosts, such as the explicitly documented GETTR media domains. 4. Resolve hostnames and verify that resolved addresses do not map to prohibited address ranges; repeat validation after redirects where practical. 5. Configure ffmpeg with an explicit protocol allowlist appropriate for HTTPS and HLS operation. 6. Apply connection, read, duration, and output-size limits to reduce denial-of-service exposure. 7. If arbitrary non-GETTR sources are an intentional feature, clearly document that broader trust boundary and require explicit user confirmation before accessing them. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose describes a broader workflow: taking a GETTR URL, downloading audio from the post or stream, and transcribing it locally with MLX Whisper including timestamps/VTT output. The provided code chunk is only a narrow helper that extracts audio from an already-supplied media URL using ffmpeg and writes a WAV file. That audio extraction step is related, but the primary declared behavior—transcription and timestamp generation—is absent. Additionally, the script is not GETTR-specific; it expects a direct m3u8 or mp4 URL, not a GETTR page/post URL parser or downloader. Therefore the description materially overstates what this code chunk actually does.

Static analysis

No suspicious patterns detected.